Pierluigi Paganini December 26, 2019

Experts spotted a new strain of the Ryuk Ransomware that was developed to avoid encrypting folders commonly seen in *NIX operating systems.

Recently the City of New Orleans was the victim of ransomware attack, researchers from the BleepingComputer community revealed that the malware that infected the City’s systems was the Ryuk Ransomware. The experts found on the infected systems an executable named v2.exe.

The popular malware researcher Vitali Kremez that analyzed the sample involved in the attack discovered a new feature implemented in this new variant of malware. Kremez noticed that the ransomware doesn’t encrypt folders that are associated with *NIX operating systems.

The researcher noticed that this variant of the Ryuk ransomware doesn’t encrypt files in the following *NIX folders:

bin
boot
Boot
dev
etc
lib
initrd
sbin
sys
vmlinuz
run
var

“At first glance, it seems strange that a Windows malware would blacklist *NIX folders when encrypting files.” reported BleepingComputer.

“A Linux/Unix variant of Ryuk does not exist”

Experts pointed out that known variants of the Ryuk ransomware only targets Windows systems, anyway, Windows 10 implements the Windows Subsystem for Linux (WSL) feature that allows users to install various Linux distributions directly in Windows. The installs utilize folders with the same blacklisted names and likely attackers were not interested in encrypting the *NIX system folders used by WSL to avoid impacting the functionality of the operating system. Don’t forget that the main goal of ransomware is encrypting data without impacting the underlying operating system.

Pierluigi Paganini

(SecurityAffairs – Ryuk ransomware, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]